> ## Documentation Index > Fetch the complete documentation index at: https://docs.hiloop.ai/llms.txt > Use this file to discover all available pages before exploring further. # Glossary > Common hiloop terms and how they relate to each other. ## Agent harness The process or program that runs an agent. It might call LLM APIs, invoke tools, access files, run tests, or emit telemetry. Distinct from the [workload identity](#workload-identity) it can be launched *as*. ## Annotation A structured judgment recorded against a [run](#run) — an eval score, a pass/fail label, a reviewer's note. Annotations are [telemetry events](#telemetry-event), so you filter and aggregate on them like anything else. See [Annotations](/observability/annotations). ## Annotation schema A named, versioned JSON Schema that annotation payloads are validated against at ingest. Schemas are immutable and versioned per [organization](#organization). ## API edge The boundary that authenticates every request, resolves the credential to an organization, user, and [scope](#scope), and routes it to backend services. Services trust the identity the edge stamps; they don't re-authenticate. ## Artifact A stored output object produced by a runtime operation or command execution. Command stdout and stderr can be stored as artifacts. ## Capability A runtime feature a deployment either serves exactly or refuses. A request naming a capability the deployment cannot serve is rejected at admission with `unsupported_capability` rather than silently weakened. ## Capture Recording an agent's telemetry from the outside — you wrap a command with `hiloop run` instead of adding an SDK to the harness. Capture covers the harness's HTTPS traffic, its own OpenTelemetry, and its stdio, all keyed to the [run](#run) that produced them. See [Capturing telemetry](/guides/capturing-telemetry). ## Content-addressed payload A large event body — a prompt, a completion, an HTTP response — stored once in a blob store and referenced from the [event](#telemetry-event) by digest, so the event stream stays small and identical payloads are stored once. ## Data view A named, reusable [SQL query](/observability/query-telemetry) saved and run by name and re-validated on every run. See [Saved and data views](/observability/data-views). ## Egress policy The fixed outbound-network boundary of a [sandbox](#sandbox). Cluster DNS, the public internet, and the API's dedicated proof-authenticated capture listener are reachable, while other sandboxes, all other cluster services, private and link-local addresses, and cloud metadata are denied outside the guest. The workload has no capture proof. There are no per-sandbox network modes or destination lists. See [Network egress](/sandboxes/network-egress). ## Execution A command run inside a sandbox. Executions track state, exit code, sandbox id, and output artifact ids. ## Idempotency key An optional, client-generated key used only on create-style mutations to make retries safe. Reuse the same key with the same body to retry without creating duplicate work; the SDKs generate one automatically. ## Lineage path A [run](#run)'s dotted, time-sortable path of run ids from the root of its tree, such as `01H8A.01H8B`. A subtree is addressable by prefix, so queries can scope to one run and all of its descendants. Telemetry events line up by the lineage path of the run that produced them. ## Operation An asynchronous control-plane action. Sandbox create, execute, stop, resume, and delete calls return operations that can be polled. ## Organization The top-level account and the isolation boundary. Projects, runs, sandboxes, workspace metadata, and telemetry all live in an organization, and a request acts only within the caller's own. An organization carries its members (users) and its API keys. ## Project An organization-scoped workspace for grouping runs, telemetry, sandboxes, and resources. ## Provider-neutral Describes the public runtime API: you request resources and [capabilities](#capability) and the platform reports what it supports, without exposing the underlying runtime's native ids or errors. The same contract holds across deployments. ## Run A captured agent workflow — also called a session. Runs may carry logical parent/child lineage; every event is keyed to the run that produced it (and its [lineage path](#lineage-path)). Don't confuse it with an API session (the cached credential from `hiloop login`). ## Run lineage The logical parent/child relationships between [runs](#run) in a project, recorded on each run and resolvable through `parent_run_id` and `root_run_id`. Lineage is recorded data you can query and group by; hiloop does not ship a dedicated tree browser. Logical lineage does not promise runtime filesystem fork. ## Sandbox An isolated execution environment for an agent harness or command workload. ## Sandbox base image The reproducible starting environment a sandbox boots from, typically an exact OCI image or named immutable environment plan. ## Saved view A named `SELECT` over your telemetry, saved and run by name and re-validated on every run — the bare `{ name, sql }` primitive a [data view](#data-view) is built on. See [Saved and data views](/observability/data-views). ## Scope What a credential acts as. An **organization-scoped** credential acts across the whole [organization](#organization) — administration, billing, and all runtime and telemetry work. A **sandbox-scoped** credential is further confined to one [sandbox](#sandbox) and its own run lineage, so it can never widen its own reach. `hiloop whoami` prints your current scope. ## Secret binding A requested credential mapping for a [sandbox](#sandbox). Request-time release is proof-bound to the live sandbox, executing principal, exact grant, and destination. A deployment without the complete release path rejects such requests before launch. See [Egress and secrets](/sandboxes/egress-secrets). ## Signal The family a [telemetry event](#telemetry-event) belongs to — `llm`, `net`, `log`, `exec`, `span`, `metric`, `egress`, `runtime`, or `annotation`. Queries commonly filter or break down by signal. See [the signal reference](/observability/event-model#signals). ## Snapshot An immutable capture of one [sandbox](#sandbox)'s disk state, usable as the source for new sandboxes. Creating from a snapshot is restore, fork, and branch in one verb. See [Snapshots and branching](/concepts/workspaces). ## Storage class The backing-storage behavior chosen when a [sandbox](#sandbox) is created: `standard` (node-bound, the default) or `durable` (deployment-backed storage that recovers `/workspace` after node loss). See [Sandboxes](/concepts/sandboxes#workspace). ## Subtree A [run](#run) and all runs descending from it in [run lineage](#run-lineage). A query can scope to a subtree; see [querying telemetry](/guides/querying-telemetry). ## Telemetry event A structured observation attached to a [run](#run). Events have a [signal](#signal), name, typed attributes, and optional payload reference. ## Telemetry gateway The service that ingests captured [events](#telemetry-event), derives the [organization](#organization) from the credential, and serves SQL queries. `hiloop run` exports to it; `hiloop query` reads from it. ## Run-scoped observability An observability model where every [telemetry event](#telemetry-event) is keyed to the [run](#run) that produced it. Runs also record logical lineage, so a query can additionally scope to a related subtree when that is useful. See [Run-scoped observability](/concepts/run-scoped-observability). ## Workload identity A named, organization-scoped machine identity a [run](#run) can be launched as — the identity an [agent harness](#agent-harness) runs *as*, distinct from the harness itself. A workload has no login and no console; it is registered explicitly, carries an owner trail and a launch ACL, and gives attribution and policy (such as an [egress policy](#egress-policy)) something to bind to per identity. Declare it with `hiloop run --as workload/`. See [Workload identity](/concepts/workload-identity). ## Workspace The `/workspace` directory inside a [sandbox](#sandbox), where code and durable data belong. Its lifetime is set by the [storage class](#storage-class) chosen at create. See [Snapshots and branching](/concepts/workspaces).